Mr. Glasser

Security & Safety

Business Continuity Basics

By Marc Glasser, Managing Director, RM LLC

This article addresses business continuity basics. Business continuity management is complex and generally industry and even site-specific. In the hotel industry, the overall mission and function of a hotel and/or hotel company is generally consistent. It provides for-profit lodging accommodations and associated services. While there is a significant "range" of hotel venues and services from luxury high-end to budget conscious consumer markets, the overall mission remains the same. In terms of business continuity, independent of hotel "range", alike or not, each specific hotel venue will have its own unique business continuity management program, whose program's objectives and outcomes are generated by a business continuity assessment and corresponding Business Impact Analysis, adequate senior management support and program asset allocation, professional business continuity plan development, implementation and ongoing management.

Business continuity program encompasses all aspects of an organization's business continuity. A business continuity plan is a component of the business continuity program. A business continuity plan documents continuity and recovery procedures to be implemented during and after disruptive conditions. The hotel's business continuity plan addresses venue specific continuity and recovery procedures actions supported by appropriate training, plan testing (or actual plan implementation during times of likely or actual disruption) and modifying the business continuity program and plan based on "lessons learned". This article is not intended to qualify one to implement a business continuity management plan but rather to touch upon business continuity basics, raise awareness of the importance of a business continuity plan, and further qualify one to facilitate others initiating or reevaluating one's hotel specific business continuity plan.

Fundamentally, effective business continuity is the ability to function by providing essential services under disruptive conditions. Business continuity management is the process that focuses on developing, implementing and maintaining organizational capabilities, before, during and after a possible disruption. Disruption can be generally classified as natural, technical and human induced.

Natural disasters include flooding, hurricanes, tornadoes, tsunamis, weather extremes or unusual weather events (unusual in the sense that the location is unprepared for the generally "rare" weather event). The aforementioned "rapid onset" weather disasters come to mind, generally less often than "slow onset disasters" such as prolonged drought conditions. Technical disaster events include data, utility (e.g. power, water, Internet provider) or critical supply chain component disruption or unavailability as well as hazardous material incidents. Human induced disasters include terrorism, civil unrest, sabotage, vandalism, arson. Human induced disasters can be intentional ("on purpose" such as internal/employee induced disaster) or accidental (human error or oversight).

Disruptive conditions can have a catastrophic business continuity (and otherwise) "cascading effect". The following, while not hotel specific, is an appropriate, although unfortunate, "cascading effect" catastrophic example. The March 2011 Japanese Fukushima Daiichi catastrophe was result of an earthquake, tsunami and nuclear disaster. Concisely stated, the Fukushima Daiichi catastrophe was result of the cascading effects of a 9.0 magnitude earthquake induced tsunami causing shutdown of active reactors at the Fukushima nuclear power plant. The earthquake induced tsunami struck the power plant disabling backup diesel generators required to cool the reactors. The lack of cooling led to explosions and Fukushima reactor meltdowns. Additionally, radioactive emissions hampered response and recovery activities.

According to a report from the National Police Agency in Japan, the total casualties consisted of over 15,000 deaths, over six thousand injured, in excess of 125,000 buildings completely collapsed, and over 900,000 buildings partially collapsed. Additionally, roads, dams, and railroads were damaged and fires broke out in many areas. As a result of the cascading event induced disaster, millions of Japanese lost power and water. According to The World Bank's estimation of the economic cost, this was the most expensive natural disaster to date, costing over $200 billion. This tragic disaster, where effects could have been prevented or mitigated with appropriate allocation of resources and senior management buy-in, quantifiably illustrates loss of: life; assets and services as well as personal injury. Prevention could have been facilitated by identifying likely threats (including cascading effects) and, based on an effective risk assessment, the facility could have been built elsewhere. Mitigation could have been enhanced with initial project construction including additional backup generators elevated above sea level, located further inland and appropriately housed.

The discussion above emphasizes the importance of identifying business continuity threats based on appropriate risk assessment, prevention and mitigation as well as the importance of quantifying possible disruptive costs of a nonexistent or insufficient business continuity plan. A comprehensive business continuity program identifies and quantifies direct and indirect disruptive event potential financial losses. Direct financial losses include destruction of hotel assets and loss of revenue. Indirect financial losses include loss of customer satisfaction and investor confidence, specific hotel and hotel brand/parent company reputation damage and negative media coverage. Additionally, the discussion above highlights the interaction of many business components related to business continuity. First and foremost, senior management buy-in is required for support to include appropriate allocation of resources and cooperation from each business unit. Many business units/functions will be involved including security, crisis management, information technology, legal, public and stakeholder relations, human resources and union representation (if applicable) which will help ensure individual employee awareness and participation as well as the accuracy of information utilized in the business continuity plan. Additionally, external stakeholder participation will further enhance the business plan's effectiveness as interacting with utility providers, vendors, local media and first responders (i.e., police, fire, ambulance/EMT service) will provide accurate information as a basis for prevention, mitigation and recovery strategies.

The accurate identification of business continuity risks and the associated extent of advance/proactive prevention and mitigation are the determining factors that are the foundation of a hotel specific business continuity management program. Additionally, an effective hotel business continuity management program must have experienced business continuity personnel developing and managing the business continuity plan. Individual hotels (each hotel location) should be assessed based on natural, technical and human induced threats. Identifying the most likely risks should drive each hotel venue's business continuity management program and corresponding resource allocation based on "rank order" of business risks. The most likely and consequential business continuity risks prioritized/addressed over the less likely. How can this be accomplished objectively? The fundamental business continuity tool known as the "Business Impact Analysis" (a.k.a. BIA"), when properly implemented, accomplishes the aforementioned. A properly conducted BIA determines the hotels' objective priorities, deliverables, resources and processes to execute deliverables. Further, the BIA identifies objective priorities in terms of specific activities, critical resources, business impact of disruptions over time and recovery time and point objectives [a.k.a., Recovery Time Objective (RTO) and Recovery Point Objective (RPO)]. The BIA determines the resource requirements for critical business units supporting the hotel's mission. Resource requirement identification includes human capital, physical structure (i.e., hotel structure/building/complex itself), informational (e.g., information technology, data, vital records, other communication requirements) utilities, materials, supply chain vulnerabilities, etc. Clearly, the completion and complexity of the BIA is beyond the scope of this basic article. Further, a BIA can identify single and multiple points of failure, and more comprehensively, appropriate prevention, mitigation and recovery strategies.

The appropriately identified prevention, mitigation and recovery strategies are the foundation for the emergency response and the business continuity plans. Once these plans have been finalized and approved by senior management, plan implementation includes writing and distributing the plan and promoting awareness, training, testing as well as ongoing program and plan management. It is important to note that generally, senior management will determine the organization's "risk tolerance" relating to the business continuity management program and beyond. Risk tolerance levels include avoidance, transfer, mitigation, and acceptance. Risk avoidance are actions taken to completely eliminate or avoid the risk. For example, a facility relocation from Oklahoma City to Las Vegas eliminates the "tornado" risk. Likewise, if the decision is made to permanently or temporarily close a hotel in a high threat location the threat to hotel customers and employees at that location is eliminated. Risk transfer, is best illustrated by the use of insurance policies and coverage. For example, senior management may decide to purchase business interruption insurance as opposed to implementing different levels of business continuity measures. Risk mitigation is implementing a measure that reduces the severity but does not eliminate the risk completely. For example, installing emergency power generation will not address the main power provider failure but will mitigate the power loss. Finally, risk acceptance is where the decision is made to do nothing but "accept" the risk and possible consequences. For example, it would be risk acceptance if the decision is made to "accept" the risk of hurricane damage and other consequences for a hotel located in New Orleans without any further action.

Further, it is important that we mention the public sector's equivalent of a business continuity program which is often called Continuity of Operations (COOP) management plan. In general, both types of plans have the same purpose, which is to continue operations under disruptive circumstances. Technical differences include that COOP management plans identify "essential services" or "essential functions" and neither utilize a BIA nor identify recovery time and point objectives.

Additionally, it is also important to mention, that although not identified in a business continuity plan, individual employee and family preparedness should be addressed as it can impact the hotel's ability to adequately respond to a disruptive event. Disruptive incidents can have a significant impact on organizations and communities; hence hotel employees. If hotel employees are unable to report to work or are consumed with family wellness, the best business continuity management program will, at best be marginally acceptable , or in the worst case scenario, unable to be implemented. An effective employee and family preparedness plan will help ensure physical safety and psychological comfort enabling employees to successfully implement the business continuity management program when circumstances dictate. See related "Well-prepared Employee and Family Plans and Benefits" [enabled direct hyperlink text to Glasser's previous article] article.

For additional business continuity management program guidance, one can reference the following Federal Emergency Management Agency (FEMA) "Ready" business continuity website at http://www.ready.gov/business/implementation/continuity. Additionally, for employee and family preparedness planning information one can reference the following FEMA "PLAN TO PROTECT YOURSELF AND YOUR FAMILY" website at http://www.ready.gov/emergency-planning-checklists.

In conclusion, we have discussed the importance of senior management buy-in for business continuity program initiation and ongoing management, the importance of identifying business threats based on appropriate risk assessment and the BIA for prevention, mitigation and recovery strategies as documented and supported in the business continuity plan. Additionally, an effective business continuity program includes business continuity awareness, training, testing, ongoing program management as well as employee and family preparedness guidance.

Marc Glasser is the Managing Director of RM (Protection Risk Management) LLC. RM LLC provides security, business continuity, and emergency management services spanning the protection of life, operations, assets and stakeholder value. He directs risk management, security, and business continuity programs (including business impact and supply chain analysis) to mitigate vulnerabilities, including natural (e.g., floods, earthquakes, hurricanes), technical (e.g., utility service disruptions, hazardous materials incidents), and intentional (e.g., terrorism, theft, espionage). Mr. Glasser can be contacted at 702-809-3434 or mglasser@rmllc.com Extended Bio...

HotelExecutive.com retains the copyright to the articles published in the Hotel Business Review. Articles cannot be republished without prior written consent by HotelExecutive.com.

Receive our daily newsletter with the latest breaking news and hotel management best practices.
Hotel Business Review on Facebook
General Search:

NOVEMBER: Architecture & Design: Authentic, Interactive and Immersive

Brian Obie

When people arrive at a hotel they have usually traveled a long distance. They are typically tired and stressed to some degree or another depending on how easy or difficult the journey. When they finally come into our driveway and understand this is where they should be – with the valet right there ready to greet them – they get the sense that they can finally relax. There’s a huge sense of relief. They now can begin their business trip or holiday with the family knowing they will be rested and renewed. READ MORE

Rob Uhrin

When you think of the word resort, what comes to mind? Upscale amenities such as white sandy beaches, luxury pools, first class dining and entertainment and the ultimate spa experience to name a few. The word “resort” probably does not conjure up images of urban cityscapes, or streets filled with busy pedestrians in business suits. There is a new class of resorts coming to the fore in the hospitality industry right now called urban resorts. This article will explore this new type of transformational city design and how to achieve it. READ MORE

Vince  Stroop

In a time when experiences are moments-long and shared over Instagram by many users, it is hard to top the surprise factor when it comes to creating a new destination. Nor should we, as hotel designers, try. With the pace of changing trends that is being communicated to us by branding agencies, designing the next new thing can be tempting. But I am not sure that’s what guests genuinely seek. And judging from the rise of Airbnb, I may be right on my guess that guests want memorable, meaningful experiences, not more selfies. READ MORE

Michael Tall

An urban resort is a property that connects guests to the unique and vibrant elements within a city and outside the hotel. The hotel itself acts as a concierge service, forming a direct link between the local community and those guests who crave localized and authentic excursions. With no signs of slowing down, the urban resort trend is here to stay, and hoteliers can successfully capitalize on this growing segment by keeping the guest experience in mind. At its core, an urban resort is a respite from daily life, offering guests the freedom to choose between relaxed disconnection or active participation within the local community. READ MORE

Coming Up In The December Online Hotel Business Review

Feature Focus
Hotel Law: Issues & Events
There is not a single area of a hotel’s operation that isn’t touched by some aspect of the law. Hotels and management companies employ an army of lawyers to advise and, if necessary, litigate issues which arise in the course of conducting their business. These lawyers typically specialize in specific areas of the law – real estate, construction, development, leasing, liability, franchising, food & beverage, human resources, environmental, insurance, taxes and more. In addition, issues and events can occur within the industry that have a major impact on the whole, and can spur further legal activity. One event which is certain to cause repercussions is Marriott International’s acquisition of Starwood Hotels and Resorts Worldwide. This newly combined company is now the largest hotel company in the world, encompassing 30 hotel brands, 5,500 hotels under management, and 1.1 million hotel rooms worldwide. In the hospitality industry, scale is particularly important – the most profitable companies are those with the most rooms in the most locations. As a result, this mega- transaction is likely to provoke an increase in Mergers & Acquisitions industry-wide. Many experts believe other larger hotel companies will now join forces with smaller operators to avoid being outpaced in the market. Companies that had not previously considered consolidation are now more likely to do so. Another legal issue facing the industry is the regulation of alternative lodging companies such as Airbnb and other firms that offer private, short-term rentals. Cities like San Francisco, Los Angeles and Santa Monica are at the forefront of efforts to legalize and control short-term rentals. However, those cities are finding it’s much easier to adopt regulations on short-term rentals than it is to actually enforce them. The December issue of Hotel Business Review will examine these and other critical issues pertaining to hotel law and how some companies are adapting to them.